SAP Fiori Launchpad Update Addresses Information Disclosure
Tech GuruQuick Answer
SAP Fiori Launchpad CVE-2026-76974 can expose information from an authenticated user's session after that user clicks a malicious link. The attacker does not need an account. Administrators should consult SAP Note 3680888 for the correction applicable to their installed component level.
Confirm Scope And Apply The Supported Fix
What to do now: Record installed SAP_UI and SAP_BASIS levels, obtain SAP Note 3680888 through the authorized support account, and verify its correction and prerequisites before scheduling the change.
Open SAP Note 3680888 (authorized support access may be required). The public SAP CVE record establishes the affected components and impact, not the implementation details.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | SAP Fiori Launchpad components SAP_UI 757, 758, 816, and SAP_BASIS 918 |
|---|---|
| Advisory | SAP Security Note 3680888 |
| CVE | CVE-2026-76974 |
| Authoritative release date | SAP Note publication not verified. SAP's CVE record was published 2026-09-22T00:28:40.930Z. |
| Authority revision date | SAP Note revision not verified. CVE record updated 2026-09-22T10:25:33.735Z; that is not a verified vendor-note revision time. |
| Affected versions | SAP_UI 757, 758, and 816 and SAP_BASIS 918, as listed by the SAP CNA. |
| Fixed version | Not established by the public sources checked. Use SAP Note 3680888 to select the correction and prerequisites for the installed component level; do not infer a fixed build from the CVE record. |
| CVSS base score | 5.3 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | SAP's public CNA description does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
SAP's public CVE record identifies insufficient input validation that can make the browser load attacker-controlled external content. Its 5.3 vector describes confidentiality impact, with no integrity or availability impact. The public record names affected components but does not establish a fixed support-package build or the note's implementation prerequisites.
What To Validate Now
- Inventory. Locate SAP Fiori Launchpad components SAP_UI 757, 758, 816, and SAP_BASIS 918 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: SAP_UI 757, 758, and 816 and SAP_BASIS 918, as listed by the SAP CNA. Do not infer applicability from product family or severity alone.
- Remediate. Apply the correction specified in SAP Note 3680888 only after confirming its applicability, prerequisites and supported transport/update procedure. The public CVE entry is not a replacement for those instructions.
- Validate. Retain the implemented note revision and resulting component levels, then test approved Fiori launchpad navigation and authentication workflows. Record the actual tests; this review did not validate a local correction.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
